Cookie Scout

Cookie Scout helps you display a cookie banner, store consent and control scripts. The plugin can be used locally without an account. Advanced features can be enabled separately.

External services

This plugin communicates with third-party services only when a feature explicitly needs it, or when an administrator has turned that feature on. Below is what is used, why, what data is involved, and when it runs.

Cookie Scout API (dashboard.cookiescout.io)

• What it is: The Cookie Scout account and configuration service.

• What it is used for: Optional connected mode: authenticating the site owner, loading banner and policy configuration, blocking rules, categories, and (when enabled) recording consent events from the banner to your Cookie Scout account.

• What data is sent: API requests may include your site URL, authentication token after you connect, banner or policy fields you save from the settings screens, and consent payloads (consent identifier, category choices, banner version reference, page URL, and language) when the visitor consents and connected mode is active.

• When it is sent: Only when a site administrator has connected the plugin to a Cookie Scout account and performs actions that require the service, or when visitors submit consent while that connected mode is active.

• Provider: Cookie Scout — Website — Account dashboard — Terms of use — Privacy policy

Google Tag Manager and Google Tag (googletagmanager.com)

• What it is: Google’s tag hosting and execution platform.

• What it is used for: If an administrator enters a valid Google Tag Manager container ID (format GTM-… ) in the plugin settings, the plugin can load Google Tag Manager on the public site in line with the selected Consent Mode behaviour (standard vs advanced). The browser may then load additional tags configured in that container.

• What data is sent: The plugin requests Google’s gtm.js (and the GTM noscript iframe when applicable) from Google. Any further requests, cookies, or personal data depend entirely on what the administrator has configured inside Google Tag Manager and the tags fired from it—not on this plugin’s code paths beyond loading GTM when allowed by consent settings.

• When it is sent: When GTM is configured in settings and, depending on mode, when consent allows statistics or marketing storage, or when advanced Consent Mode is enabled as described in the plugin UI.

• Provider: Google Ireland Limited / Google LLC — Google Tag Manager terms — Google privacy policy

Google Fonts (fonts.googleapis.com / fonts.gstatic.com)

• What it is: Google’s font delivery network.

• What it is used for: If an administrator selects one of the listed Google fonts for the cookie policy / cookie list appearance, the visitor’s browser loads the corresponding stylesheet (and font files) from Google.

• What data is sent: Standard web requests as defined by Google (typically IP address and technical headers as part of loading CSS/font assets).

• When it is sent: Only when a Google font is chosen in settings and a page that outputs the policy or list shortcodes is viewed.

• Provider: Google — Google Fonts privacy FAQ — Google privacy policy

Stripe (checkout.stripe.com)

• What it is: Payment processing for Cookie Scout plans, when you use connected checkout from the plugin.

• What it is used for: Redirecting the administrator to Stripe Checkout when purchasing or upgrading through the Cookie Scout service.

• What data is sent: Handled by Cookie Scout’s checkout API and Stripe according to their flows; this plugin only redirects the administrator to the checkout URL returned by the service.

• When it is sent: Only when an administrator starts checkout from the plugin while using connected mode.

• Provider: Stripe — Stripe legal / privacy

Front-end requests to your own site (scanner / GTM detection)

• What it is: The plugin may request your site’s public HTML using wp_remote_get() (for example the basic scanner in admin, or optional detection of an existing GTM snippet).

• What it is used for: Analysing HTML your site already outputs; the plugin does not substitute remote CDNs for its own assets through these requests.

• What data is sent: A normal HTTP GET to your home_url() as seen by the server (user-agent identifies the plugin).

• When it is sent: Only when an administrator triggers the relevant tool in wp-admin.